DebTik/internal/routing/manager.go

package routing

import (
	"bufio"
	"encoding/json"
	"errors"
	"fmt"
	"log"
	"net"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"

	"debtik/internal/sdwan"
	"github.com/vishvananda/netlink"
)

var (
	StaticRoutesStorePath = "/etc/debtik/routing/static_routes.json"
	PolicyRulesStorePath  = "/etc/debtik/routing/policy_rules.json"
	CustomTablesStorePath = "/etc/debtik/routing/custom_tables.json"
	RTTableFilePath       = "/etc/iproute2/rt_tables"
)

type RoutingManager struct {
	mu           sync.Mutex
	staticRoutes []RouteItem
	policyRules  []PolicyRuleItem
	customTables []RoutingTableItem
	stopChan     chan struct{}
}

func NewRoutingManager() *RoutingManager {
	m := &RoutingManager{
		staticRoutes: make([]RouteItem, 0),
		policyRules:  make([]PolicyRuleItem, 0),
		customTables: make([]RoutingTableItem, 0),
		stopChan:     make(chan struct{}),
	}
	m.initRTTableFile()
	m.load()
	if err := m.syncCustomTablesToSystem(); err != nil {
		log.Printf("routing table synchronization failed: %v", err)
	}
	m.applyAll()
	m.startHealthCheckWorker()
	m.startRouteSyncWorker()

	sdwan.RegisterStateChangeCallback(func() {
		m.SyncSDWANRoutes()
	})

	return m
}

func (m *RoutingManager) initRTTableFile() {
	_ = os.MkdirAll(filepath.Dir(RTTableFilePath), 0755)
	if _, err := os.Stat(RTTableFilePath); os.IsNotExist(err) {
		// Copy from /usr/share/iproute2/rt_tables or seed default
		content, err := os.ReadFile("/usr/share/iproute2/rt_tables")
		if err == nil {
			_ = os.WriteFile(RTTableFilePath, content, 0644)
		} else {
			defaultContent := "# reserved values\n255\tlocal\n254\tmain\n253\tdefault\n0\tunspec\n"
			_ = os.WriteFile(RTTableFilePath, []byte(defaultContent), 0644)
		}
	}
}

func (m *RoutingManager) load() {
	if data, err := os.ReadFile(StaticRoutesStorePath); err == nil {
		_ = json.Unmarshal(data, &m.staticRoutes)
	}
	if data, err := os.ReadFile(PolicyRulesStorePath); err == nil {
		_ = json.Unmarshal(data, &m.policyRules)
	}
	if data, err := os.ReadFile(CustomTablesStorePath); err == nil {
		_ = json.Unmarshal(data, &m.customTables)
	}

	// Deduplicate static routes: if duplicates exist, keep the latest entry
	seenIDs := make(map[string]bool)
	seenKeys := make(map[string]bool)
	var dedupedRev []RouteItem
	hasDups := false

	// Traverse from end to start so latest updates take precedence
	for i := len(m.staticRoutes) - 1; i >= 0; i-- {
		r := m.staticRoutes[i]
		if r.ID == "" {
			r.ID = fmt.Sprintf("route-%d", time.Now().UnixNano())
		}
		normDst := normalizeDst(r.DstAddress)
		tbl := r.RoutingTable
		if tbl == "" {
			tbl = "main"
		}
		gw := strings.TrimSpace(r.Gateway)
		iface := strings.TrimSpace(r.Interface)
		routeKey := fmt.Sprintf("%s|%s|%s|%s|%d", normDst, tbl, gw, iface, r.Distance)

		if seenIDs[r.ID] || seenKeys[routeKey] {
			log.Printf("[RouteManager] Pruning duplicate static route on load: ID=%s dst=%s gw=%s iface=%s", r.ID, r.DstAddress, r.Gateway, r.Interface)
			hasDups = true
			continue
		}
		seenIDs[r.ID] = true
		seenKeys[routeKey] = true
		dedupedRev = append(dedupedRev, r)
	}

	// Reverse back to original order
	var deduped []RouteItem
	for i := len(dedupedRev) - 1; i >= 0; i-- {
		deduped = append(deduped, dedupedRev[i])
	}

	if hasDups {
		m.staticRoutes = deduped
		_ = m.save()
	}

	for i := range m.staticRoutes {
		if !m.staticRoutes[i].Disabled && m.staticRoutes[i].HealthStatus != "offline" {
			m.staticRoutes[i].Active = true
		}
	}
}

func (m *RoutingManager) save() error {
	_ = os.MkdirAll("/etc/debtik/routing", 0755)

	if data, err := json.MarshalIndent(m.staticRoutes, "", "  "); err != nil {
		return err
	} else if err = os.WriteFile(StaticRoutesStorePath, data, 0600); err != nil {
		return err
	}
	if data, err := json.MarshalIndent(m.policyRules, "", "  "); err != nil {
		return err
	} else if err = os.WriteFile(PolicyRulesStorePath, data, 0600); err != nil {
		return err
	}
	if data, err := json.MarshalIndent(m.customTables, "", "  "); err != nil {
		return err
	} else if err = os.WriteFile(CustomTablesStorePath, data, 0600); err != nil {
		return err
	}
	return nil
}

func (m *RoutingManager) syncCustomTablesToSystem() error {
	content, err := os.ReadFile(RTTableFilePath)
	if err != nil && !os.IsNotExist(err) {
		return fmt.Errorf("reading routing table registry: %w", err)
	}
	var sb strings.Builder
	sb.Write(content)
	if len(content) > 0 && content[len(content)-1] != '\n' {
		sb.WriteByte('\n')
	}
	existing := map[string]bool{}
	for _, line := range strings.Split(string(content), "\n") {
		fields := strings.Fields(line)
		if len(fields) >= 2 && !strings.HasPrefix(fields[0], "#") {
			existing[fields[1]] = true
		}
	}
	for _, table := range m.customTables {
		if !existing[table.Name] {
			fmt.Fprintf(&sb, "%d\t%s\n", table.TableID, table.Name)
			existing[table.Name] = true
		}
	}
	dir := filepath.Dir(RTTableFilePath)
	f, err := os.CreateTemp(dir, ".rt-tables-*.tmp")
	if err != nil {
		return err
	}
	name := f.Name()
	defer os.Remove(name)
	if err = f.Chmod(0644); err == nil {
		_, err = f.WriteString(sb.String())
	}
	if err == nil {
		err = f.Sync()
	}
	if closeErr := f.Close(); err == nil {
		err = closeErr
	}
	if err != nil {
		return err
	}
	return os.Rename(name, RTTableFilePath)
}

func (m *RoutingManager) cleanRogueDefaultRoutes() {
	hasManagedDefault := false
	for _, r := range m.staticRoutes {
		if normalizeDst(r.DstAddress) == "default" && !r.Disabled {
			hasManagedDefault = true
			break
		}
	}

	if !hasManagedDefault {
		return
	}

	routes, err := netlink.RouteList(nil, netlink.FAMILY_V4)
	if err != nil {
		return
	}

	links, _ := netlink.LinkList()
	linkMap := make(map[int]string)
	for _, l := range links {
		linkMap[l.Attrs().Index] = l.Attrs().Name
	}

	for _, r := range routes {
		if (r.Table == 254 || r.Table == 0) && r.Dst == nil && len(r.MultiPath) == 0 {
			gw := ""
			if r.Gw != nil {
				gw = r.Gw.String()
			}
			ifName := linkMap[r.LinkIndex]
			// If priority is 0 (unmetered route from dhclient or boot) and protocol != RTPROT_STATIC:
			if r.Priority == 0 && int(r.Protocol) != 4 {
				log.Printf("[RouteManager] Removing rogue unmanaged default route: via %s dev %s proto %d", gw, ifName, r.Protocol)
				_ = netlink.RouteDel(&r)
			}
		}
	}
}

func (m *RoutingManager) getTableIDByName(name string) int {
	name = strings.TrimSpace(name)
	if name == "" || name == "main" {
		return 254
	}
	if name == "default" {
		return 253
	}
	if name == "local" {
		return 255
	}
	for id, n := range m.getTableMap() {
		if strings.EqualFold(n, name) {
			return id
		}
	}
	if id, err := strconv.Atoi(name); err == nil {
		return id
	}
	return 254
}

func (m *RoutingManager) startRouteSyncWorker() {
	ticker := time.NewTicker(3 * time.Second)
	go func() {
		for {
			select {
			case <-m.stopChan:
				ticker.Stop()
				return
			case <-ticker.C:
				m.syncAllRoutesWorker()
			}
		}
	}()
}

func (m *RoutingManager) syncAllRoutesWorker() {
	m.mu.Lock()
	defer m.mu.Unlock()

	// Unmanaged routes belong to DHCP, the host or other routing daemons.

	liveRoutes, err := netlink.RouteList(nil, netlink.FAMILY_V4)
	if err != nil {
		return
	}

	type groupKey struct {
		dst   string
		table int
		dist  int
	}

	kernelRouteGroups := make(map[groupKey]bool)
	for _, lr := range liveRoutes {
		dst := "default"
		if lr.Dst != nil {
			dst = lr.Dst.String()
		}
		tbl := lr.Table
		if tbl == 0 {
			tbl = 254
		}
		k := groupKey{dst: normalizeDst(dst), table: tbl, dist: lr.Priority}
		kernelRouteGroups[k] = true
	}

	seen := make(map[groupKey]bool)
	for _, r := range m.staticRoutes {
		if r.Disabled || r.HealthStatus == "offline" {
			continue
		}
		normDst := normalizeDst(r.DstAddress)
		tableID := m.getTableIDByName(r.RoutingTable)
		k := groupKey{dst: normDst, table: tableID, dist: r.Distance}
		if !seen[k] {
			seen[k] = true
			if !kernelRouteGroups[k] {
				log.Printf("[RouteSync] Missing kernel route %s table %s (id %d) metric %d -> Restoring", normDst, r.RoutingTable, tableID, r.Distance)
				if err := m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance); err != nil {
					log.Printf("route synchronization failed: %v", err)
				}
			}
		}
	}
}

func (m *RoutingManager) applyAll() {
	// Unmanaged routes belong to DHCP, the host or other routing daemons.

	// Apply all static routes grouped by (dst, table, distance) for ECMP
	type groupKey struct {
		dst   string
		table string
		dist  int
	}
	seen := make(map[groupKey]bool)
	for _, r := range m.staticRoutes {
		normDst := normalizeDst(r.DstAddress)
		tbl := strings.TrimSpace(r.RoutingTable)
		if tbl == "" {
			tbl = "main"
		}
		k := groupKey{dst: normDst, table: tbl, dist: r.Distance}
		if !seen[k] {
			seen[k] = true
			_ = m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance)
		}
	}

	// Apply policy rules
	for _, pr := range m.policyRules {
		_ = m.applyRuleToKernel(pr)
	}
}

// ==================== Routes (/ip route) ====================

func isDynamicProtocol(proto netlink.RouteProtocol) bool {
	switch int(proto) {
	case 11, // RTPROT_ZEBRA
		12,  // RTPROT_BIRD
		16,  // RTPROT_DHCP
		42,  // RTPROT_BABEL
		186, // RTPROT_BGP
		187, // RTPROT_ISIS
		188, // RTPROT_OSPF
		189, // RTPROT_RIP
		192: // RTPROT_EIGRP
		return true
	default:
		return false
	}
}

func getRouteProtocolName(proto netlink.RouteProtocol, priority int, isDirect bool, isMulticast bool) string {
	if isMulticast {
		return "multicast"
	}
	switch int(proto) {
	case 16:
		return "dhcp"
	case 4:
		return "static"
	case 186:
		return "bgp"
	case 188:
		return "ospf"
	case 189:
		return "rip"
	case 11:
		return "zebra"
	case 42:
		return "babel"
	case 12: // RTPROT_BIRD
		if priority == 20 {
			return "bgp"
		} else if priority == 200 {
			return "ibgp"
		} else if priority == 110 {
			return "ospf"
		} else if priority == 120 {
			return "rip"
		}
		return "bgp"
	case 2:
		return "connected"
	case 3:
		return "boot"
	default:
		if isDirect {
			return "connected"
		}
		if priority == 20 {
			return "bgp"
		} else if priority == 200 {
			return "ibgp"
		} else if priority == 110 {
			return "ospf"
		} else if priority == 120 {
			return "rip"
		}
		return "static"
	}
}

func (m *RoutingManager) listLiveRoutesLocked() []RouteItem {
	tableNames := m.getTableMap()
	links, _ := netlink.LinkList()
	linkMap := make(map[int]string)
	for _, l := range links {
		linkMap[l.Attrs().Index] = l.Attrs().Name
	}

	var liveRoutes []RouteItem
	routes, err := netlink.RouteList(nil, netlink.FAMILY_V4)
	if err == nil {
		for _, r := range routes {
			dst := "0.0.0.0/0"
			if r.Dst != nil {
				dst = r.Dst.String()
			}
			gw := ""
			if r.Gw != nil {
				gw = r.Gw.String()
			}

			tableName := "main"
			if name, ok := tableNames[r.Table]; ok {
				tableName = name
			} else if r.Table != 254 && r.Table != 0 {
				tableName = strconv.Itoa(r.Table)
			}

			isDyn := isDynamicProtocol(r.Protocol)
			isDirect := (r.Scope == netlink.SCOPE_LINK || r.Protocol == netlink.RouteProtocol(2)) && !isDyn && r.Protocol != 4
			isStatic := !isDirect && !isDyn
			isMulticast := r.Type == 5 || strings.HasPrefix(dst, "224.") || strings.HasPrefix(dst, "ff") || dst == "224.0.0.0/4"
			protoName := getRouteProtocolName(r.Protocol, r.Priority, isDirect, isMulticast)

			if len(r.MultiPath) > 0 {
				for _, nh := range r.MultiPath {
					nhGw := ""
					if nh.Gw != nil {
						nhGw = nh.Gw.String()
					}
					nhIfName := linkMap[nh.LinkIndex]
					cleanDst := strings.ReplaceAll(dst, "/", "_")
					cleanGw := nhGw
					if cleanGw == "" {
						cleanGw = nhIfName
					}
					routeID := fmt.Sprintf("kr-%d-%s-%s-m%d-p%d-t%d", r.Table, cleanDst, cleanGw, r.Priority, r.Protocol, r.Type)

					liveRoutes = append(liveRoutes, RouteItem{
						ID:           routeID,
						DstAddress:   dst,
						Gateway:      nhGw,
						Interface:    nhIfName,
						Distance:     r.Priority,
						Protocol:     protoName,
						RoutingTable: tableName,
						TableID:      r.Table,
						Active:       true,
						Connect:      isDirect,
						Dynamic:      isDyn,
						Static:       isStatic,
						ECMP:         true,
						IsMultiPath:  true,
						Multicast:    isMulticast,
						Disabled:     false,
					})
				}
				continue
			}

			ifName := linkMap[r.LinkIndex]
			act := "lookup"
			if r.Type == 6 { // RTN_BLACKHOLE
				gw = "blackhole"
				act = "blackhole"
			}

			cleanDst := strings.ReplaceAll(dst, "/", "_")
			cleanGw := gw
			if cleanGw == "" {
				cleanGw = ifName
			}
			routeID := fmt.Sprintf("kr-%d-%s-%s-m%d-p%d-t%d", r.Table, cleanDst, cleanGw, r.Priority, r.Protocol, r.Type)

			liveRoutes = append(liveRoutes, RouteItem{
				ID:           routeID,
				DstAddress:   dst,
				Gateway:      gw,
				Action:       act,
				Interface:    ifName,
				Distance:     r.Priority,
				Protocol:     protoName,
				RoutingTable: tableName,
				TableID:      r.Table,
				Active:       true,
				Connect:      isDirect,
				Dynamic:      isDyn,
				Static:       isStatic,
				Multicast:    isMulticast,
				Disabled:     false,
			})
		}
	}
	return liveRoutes
}

func (m *RoutingManager) ListRoutes() []RouteItem {
	m.mu.Lock()
	defer m.mu.Unlock()

	liveRoutes := m.listLiveRoutesLocked()

	// Merge static routes that might be disabled or have custom metadata
	matchedLive := make(map[int]bool)
	kernelRouteCount := len(liveRoutes)
	for _, sr := range m.staticRoutes {
		normSrDst := normalizeDst(sr.DstAddress)
		found := false
		for i, lr := range liveRoutes[:kernelRouteCount] {
			if sr.Disabled || !lr.Static || lr.Protocol != "static" || matchedLive[i] {
				continue
			}
			if normalizeDst(lr.DstAddress) != normSrDst {
				continue
			}
			if !sameRouteGroup(lr, sr) {
				continue
			}
			gwMatches := sr.Gateway == "" || lr.Gateway == sr.Gateway || lr.Interface == sr.Gateway || (sr.Interface != "" && lr.Interface == sr.Interface)
			if !gwMatches && (sdwan.IsSDWANGroup(sr.Interface) || sdwan.IsSDWANGroup(sr.Gateway)) {
				targetSDWAN := sr.Interface
				if !sdwan.IsSDWANGroup(targetSDWAN) {
					targetSDWAN = sr.Gateway
				}
				if resolved, ok := sdwan.ResolveGroupForRouting(targetSDWAN); ok {
					for _, nh := range resolved {
						if nh.Interface == lr.Interface || (nh.Gateway != "" && nh.Gateway == lr.Gateway) {
							gwMatches = true
							break
						}
					}
				}
			}
			if gwMatches {
				matchedLive[i] = true
				liveRoutes[i].Comment = sr.Comment
				liveRoutes[i].Static = true
				liveRoutes[i].Dynamic = false
				liveRoutes[i].Protocol = "static"
				liveRoutes[i].ID = sr.ID
				if sr.Interface != "" {
					liveRoutes[i].Interface = sr.Interface
				}
				if liveRoutes[i].Gateway == "" && sr.Gateway != "" {
					liveRoutes[i].Gateway = sr.Gateway
				}
				if sr.Distance > 0 && liveRoutes[i].Distance == 0 {
					liveRoutes[i].Distance = sr.Distance
				}
				liveRoutes[i].CheckGateway = sr.CheckGateway
				liveRoutes[i].CheckTarget = sr.CheckTarget
				liveRoutes[i].CheckInterval = sr.CheckInterval
				liveRoutes[i].CheckThreshold = sr.CheckThreshold
				liveRoutes[i].HealthStatus = sr.HealthStatus
				liveRoutes[i].HealthRTT = sr.HealthRTT
				liveRoutes[i].HealthLossPct = sr.HealthLossPct
				liveRoutes[i].HealthFailCount = sr.HealthFailCount
				liveRoutes[i].HealthLastCheck = sr.HealthLastCheck
				found = true
				break
			}
		}
		if !found {
			// Inactive or disabled static route
			srCopy := sr
			srCopy.Active = false
			srCopy.Static = true
			srCopy.Dynamic = false
			srCopy.Protocol = "static"
			liveRoutes = append(liveRoutes, srCopy)
		}
	}

	// Detect Equal-Cost Multi-Path (ECMP) routes
	groupCounts := make(map[string]int)
	for _, r := range liveRoutes {
		if r.Active && !r.Disabled {
			key := fmt.Sprintf("%s|%s|%d", normalizeDst(r.DstAddress), r.RoutingTable, r.Distance)
			groupCounts[key]++
		}
	}

	for i := range liveRoutes {
		key := fmt.Sprintf("%s|%s|%d", normalizeDst(liveRoutes[i].DstAddress), liveRoutes[i].RoutingTable, liveRoutes[i].Distance)
		if liveRoutes[i].IsMultiPath || (liveRoutes[i].Active && !liveRoutes[i].Disabled && groupCounts[key] > 1) {
			liveRoutes[i].ECMP = true
		}
		if liveRoutes[i].DstAddress == "224.0.0.0/4" || strings.HasPrefix(liveRoutes[i].DstAddress, "224.") || strings.HasPrefix(liveRoutes[i].DstAddress, "ff") {
			liveRoutes[i].Multicast = true
		}
	}

	sort.Slice(liveRoutes, func(i, j int) bool {
		if liveRoutes[i].RoutingTable != liveRoutes[j].RoutingTable {
			return liveRoutes[i].RoutingTable < liveRoutes[j].RoutingTable
		}
		if liveRoutes[i].DstAddress != liveRoutes[j].DstAddress {
			return liveRoutes[i].DstAddress < liveRoutes[j].DstAddress
		}
		return liveRoutes[i].Gateway < liveRoutes[j].Gateway
	})

	return liveRoutes
}

// Route groups are keyed by destination, table and metric, not nexthop.
func sameRouteGroup(a, b RouteItem) bool {
	table := func(s string) string {
		s = strings.TrimSpace(s)
		if s == "" {
			return "main"
		}
		return s
	}
	return normalizeDst(a.DstAddress) == normalizeDst(b.DstAddress) && table(a.RoutingTable) == table(b.RoutingTable) && a.Distance == b.Distance
}

func (m *RoutingManager) SaveRoute(r *RouteItem) (err error) {
	if r == nil {
		return fmt.Errorf("route cannot be nil")
	}
	m.mu.Lock()
	defer m.mu.Unlock()
	before := append([]RouteItem(nil), m.staticRoutes...)
	var oldRouteToClean *RouteItem
	var unmanagedOriginal *RouteItem
	dirty, newAttempted, oldAttempted := false, false, false
	defer func() {
		if err == nil || !dirty {
			return
		}
		m.staticRoutes = append([]RouteItem(nil), before...)
		if unmanagedOriginal != nil {
			m.staticRoutes = append(m.staticRoutes, *unmanagedOriginal)
		}
		var failures []error
		failures = append(failures, err)
		if newAttempted {
			if rollbackErr := m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance); rollbackErr != nil {
				failures = append(failures, fmt.Errorf("restoring new route group: %w", rollbackErr))
			}
		}
		if oldAttempted && oldRouteToClean != nil && !sameRouteGroup(*oldRouteToClean, *r) {
			if rollbackErr := m.syncRouteGroupToKernel(oldRouteToClean.DstAddress, oldRouteToClean.RoutingTable, oldRouteToClean.Distance); rollbackErr != nil {
				failures = append(failures, fmt.Errorf("restoring original route group: %w", rollbackErr))
			}
		}
		m.staticRoutes = before
		if saveErr := m.save(); saveErr != nil {
			failures = append(failures, fmt.Errorf("restoring saved routes: %w", saveErr))
		}
		err = errors.Join(failures...)
	}()

	if r.DstAddress == "" {
		return fmt.Errorf("destination address is required")
	}
	if r.DstAddress == "default" {
		r.DstAddress = "0.0.0.0/0"
	}
	if r.RoutingTable == "" {
		r.RoutingTable = "main"
	}
	if _, _, parseErr := net.ParseCIDR(r.DstAddress); parseErr != nil && net.ParseIP(r.DstAddress) == nil {
		return fmt.Errorf("invalid destination: %s", r.DstAddress)
	}
	r.Static = true

	origID := r.ID
	foundIndex := -1

	// 1. Direct ID match in static routes (if not a temporary/kernel route ID)
	if r.ID != "" && !strings.HasPrefix(r.ID, "kr-") {
		for i, existing := range m.staticRoutes {
			if existing.ID == r.ID {
				foundIndex = i
				break
			}
		}
	}

	// 2. Match by OldDstAddress / OldGateway passed from the edit modal
	if foundIndex == -1 && r.OldDstAddress != "" {
		normOldDst := normalizeDst(r.OldDstAddress)
		oldTable := r.OldRoutingTable
		if oldTable == "" {
			oldTable = "main"
		}
		for i, existing := range m.staticRoutes {
			exTbl := existing.RoutingTable
			if exTbl == "" {
				exTbl = "main"
			}
			if normalizeDst(existing.DstAddress) == normOldDst && exTbl == oldTable && (r.OldDistance == nil || existing.Distance == *r.OldDistance) {
				oldGwMatches := r.OldGateway == "" ||
					existing.Gateway == r.OldGateway ||
					existing.Interface == r.OldGateway ||
					(r.OldInterface != "" && existing.Interface == r.OldInterface)
				if oldGwMatches {
					foundIndex = i
					break
				}
			}
		}
	}

	// 3. Match by target DstAddress + Table + Gateway/Interface (prevent duplicates on re-save)
	if foundIndex == -1 {
		normNewDst := normalizeDst(r.DstAddress)
		for i, existing := range m.staticRoutes {
			exTbl := existing.RoutingTable
			if exTbl == "" {
				exTbl = "main"
			}
			if normalizeDst(existing.DstAddress) == normNewDst && exTbl == r.RoutingTable && existing.Distance == r.Distance {
				gwMatches := (existing.Gateway != "" && existing.Gateway == r.Gateway) ||
					(existing.Interface != "" && existing.Interface == r.Interface) ||
					(existing.Gateway == "" && r.Gateway == "")
				if gwMatches {
					foundIndex = i
					break
				}
			}
		}
	}

	// 4. Fallback match: if editing with OldDstAddress but gateway was changed and didn't match oldGw
	if foundIndex == -1 && r.OldDstAddress != "" {
		normOldDst := normalizeDst(r.OldDstAddress)
		oldTable := r.OldRoutingTable
		if oldTable == "" {
			oldTable = "main"
		}
		for i, existing := range m.staticRoutes {
			exTbl := existing.RoutingTable
			if exTbl == "" {
				exTbl = "main"
			}
			if normalizeDst(existing.DstAddress) == normOldDst && exTbl == oldTable && (r.OldDistance == nil || existing.Distance == *r.OldDistance) {
				foundIndex = i
				break
			}
		}
	}

	if r.CheckInterval <= 0 {
		r.CheckInterval = 5
	}
	if r.CheckThreshold <= 0 {
		r.CheckThreshold = 3
	}
	if r.CheckGateway == "internet" && strings.TrimSpace(r.CheckTarget) == "" {
		r.CheckTarget = "1.1.1.1"
	}
	if r.CheckGateway != "" && r.CheckGateway != "none" {
		if r.HealthStatus == "" {
			r.HealthStatus = "checking"
		}
	} else {
		r.CheckGateway = "none"
		r.HealthStatus = "none"
	}

	if foundIndex >= 0 {
		oldExisting := m.staticRoutes[foundIndex]
		r.ID = oldExisting.ID // Preserve persistent ID!

		if normalizeDst(oldExisting.DstAddress) != normalizeDst(r.DstAddress) ||
			oldExisting.RoutingTable != r.RoutingTable ||
			oldExisting.Distance != r.Distance ||
			oldExisting.Gateway != r.Gateway ||
			oldExisting.Interface != r.Interface {
			oldCopy := oldExisting
			oldRouteToClean = &oldCopy
		}

		if r.HealthStatus == "checking" && oldExisting.HealthStatus != "" && oldExisting.CheckGateway == r.CheckGateway {
			r.HealthStatus = oldExisting.HealthStatus
			r.HealthRTT = oldExisting.HealthRTT
			r.HealthLossPct = oldExisting.HealthLossPct
			r.HealthLastCheck = oldExisting.HealthLastCheck
		}
		dirty = true
		m.staticRoutes[foundIndex] = *r
	} else {
		if r.ID == "" || strings.HasPrefix(r.ID, "kr-") {
			r.ID = fmt.Sprintf("route-%d", time.Now().UnixNano())
		}
		// An unmanaged route may be adopted only when it is an identifiable,
		// single static route. Preserve its actual kernel values for rollback.
		if strings.HasPrefix(origID, "kr-") {
			for _, lr := range m.listLiveRoutesLocked() {
				if lr.ID == origID {
					if lr.Protocol != "static" || lr.IsMultiPath {
						return fmt.Errorf("cannot edit a dynamic or multipath kernel route")
					}
					original := lr
					unmanagedOriginal = &original
					oldRouteToClean = &original
					break
				}
			}
			if unmanagedOriginal == nil {
				return fmt.Errorf("kernel route not found: %s", origID)
			}
		}
		dirty = true
		m.staticRoutes = append(m.staticRoutes, *r)
	}

	for i := range m.staticRoutes {
		if m.staticRoutes[i].ID == r.ID {
			if !m.staticRoutes[i].Disabled && m.staticRoutes[i].HealthStatus != "offline" {
				m.staticRoutes[i].Active = true
			} else {
				m.staticRoutes[i].Active = false
			}
			break
		}
	}

	// In-memory deduplication pass on static routes
	seenKeys := make(map[string]bool)
	var deduped []RouteItem
	for _, sr := range m.staticRoutes {
		k := fmt.Sprintf("%s|%s|%s|%s|%d", normalizeDst(sr.DstAddress), sr.RoutingTable, sr.Gateway, sr.Interface, sr.Distance)
		if !seenKeys[k] {
			seenKeys[k] = true
			deduped = append(deduped, sr)
		}
	}
	m.staticRoutes = deduped

	if saveErr := m.save(); saveErr != nil {
		return saveErr
	}

	// Install the new group first to preserve connectivity when the destination
	// changes. Reconcile the old group only if its key differs.
	newAttempted = true
	if err := m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance); err != nil {
		return fmt.Errorf("applying new route group: %w", err)
	}
	if oldRouteToClean != nil && !sameRouteGroup(*oldRouteToClean, *r) && !oldRouteToClean.Disabled {
		oldAttempted = true
		if err := m.syncRouteGroupToKernel(oldRouteToClean.DstAddress, oldRouteToClean.RoutingTable, oldRouteToClean.Distance); err != nil {
			return fmt.Errorf("cleaning previous route group: %w", err)
		}
	}

	return nil
}

func (m *RoutingManager) DeleteRoute(id string) error {
	m.mu.Lock()
	defer m.mu.Unlock()

	before := append([]RouteItem(nil), m.staticRoutes...)
	var updated []RouteItem
	var target *RouteItem

	// 1. Direct ID match in static routes
	for _, r := range m.staticRoutes {
		if r.ID == id {
			targetCopy := r
			target = &targetCopy
		} else {
			updated = append(updated, r)
		}
	}

	// 2. If not found by direct ID, check if it's a live kernel route ID (e.g. kr-...)
	if target == nil {
		updated = nil
		for _, lr := range m.listLiveRoutesLocked() {
			if lr.ID == id {
				// Check if any static route corresponds to this live route
				matchIdx := -1
				normLrDst := normalizeDst(lr.DstAddress)
				for i, sr := range m.staticRoutes {
					gwMatches := sr.Gateway == "" || lr.Gateway == sr.Gateway || lr.Interface == sr.Gateway || (sr.Interface != "" && lr.Interface == sr.Interface)
					if normalizeDst(sr.DstAddress) == normLrDst && sameRouteGroup(sr, lr) && gwMatches {
						matchIdx = i
						break
					}
				}
				if matchIdx >= 0 {
					targetCopy := m.staticRoutes[matchIdx]
					target = &targetCopy
					for idx, r := range m.staticRoutes {
						if idx != matchIdx {
							updated = append(updated, r)
						}
					}
					break
				} else {
					// Do not remove routes belonging to other routing daemons or a
					// single nexthop of a multipath route.
					if lr.Protocol != "static" || lr.IsMultiPath {
						return fmt.Errorf("cannot delete a dynamic or multipath kernel route")
					}
					return m.deleteDirectKernelRoute(lr)
				}
			}
		}
	}

	if target != nil {
		m.staticRoutes = updated
		return m.commitManagedRouteChange(before, *target)
	}

	return fmt.Errorf("route not found")
}

// commitManagedRouteChange is called with the routing manager lock held.
func (m *RoutingManager) commitManagedRouteChange(before []RouteItem, route RouteItem) error {
	if err := m.save(); err != nil {
		m.staticRoutes = before
		return errors.Join(fmt.Errorf("saving route change: %w", err), m.save())
	}
	if err := m.syncRouteGroupToKernel(route.DstAddress, route.RoutingTable, route.Distance); err != nil {
		m.staticRoutes = before
		saveErr := m.save()
		reapplyErr := m.syncRouteGroupToKernel(route.DstAddress, route.RoutingTable, route.Distance)
		if saveErr != nil {
			saveErr = fmt.Errorf("restoring stored routes: %w", saveErr)
		}
		if reapplyErr != nil {
			reapplyErr = fmt.Errorf("reapplying previous route: %w", reapplyErr)
		}
		return errors.Join(fmt.Errorf("applying route change: %w", err), saveErr, reapplyErr)
	}
	return nil
}

func (m *RoutingManager) SetRouteState(id string, disabled bool) error {
	m.mu.Lock()
	defer m.mu.Unlock()

	for i := range m.staticRoutes {
		if m.staticRoutes[i].ID == id {
			before := append([]RouteItem(nil), m.staticRoutes...)
			m.staticRoutes[i].Disabled = disabled
			if !disabled && m.staticRoutes[i].HealthStatus != "offline" {
				m.staticRoutes[i].Active = true
			} else if disabled {
				m.staticRoutes[i].Active = false
			}
			return m.commitManagedRouteChange(before, m.staticRoutes[i])
		}
	}

	// If not in staticRoutes, could be a live route ID (kr-...)
	for _, lr := range m.listLiveRoutesLocked() {
		if lr.ID == id {
			// Check if any static route corresponds to this live route
			normLrDst := normalizeDst(lr.DstAddress)
			for i := range m.staticRoutes {
				gwMatches := m.staticRoutes[i].Gateway == "" || lr.Gateway == m.staticRoutes[i].Gateway || lr.Interface == m.staticRoutes[i].Gateway || (m.staticRoutes[i].Interface != "" && lr.Interface == m.staticRoutes[i].Interface)
				if normalizeDst(m.staticRoutes[i].DstAddress) == normLrDst && sameRouteGroup(m.staticRoutes[i], lr) && gwMatches {
					before := append([]RouteItem(nil), m.staticRoutes...)
					m.staticRoutes[i].Disabled = disabled
					if !disabled && m.staticRoutes[i].HealthStatus != "offline" {
						m.staticRoutes[i].Active = true
					} else if disabled {
						m.staticRoutes[i].Active = false
					}
					return m.commitManagedRouteChange(before, m.staticRoutes[i])
				}
			}

			// If pure kernel static route, adopt into staticRoutes as disabled
			if disabled {
				if lr.Protocol != "static" || lr.IsMultiPath {
					return fmt.Errorf("cannot disable a dynamic or multipath kernel route")
				}
				lr.Disabled = true
				lr.Static = true
				lr.Active = false
				lr.ID = fmt.Sprintf("route-%d", time.Now().UnixNano())
				before := append([]RouteItem(nil), m.staticRoutes...)
				m.staticRoutes = append(m.staticRoutes, lr)
				if err := m.save(); err != nil {
					m.staticRoutes = before
					return fmt.Errorf("saving adopted route: %w", err)
				}
				if err := m.syncRouteGroupToKernel(lr.DstAddress, lr.RoutingTable, lr.Distance); err != nil {
					m.staticRoutes = before
					return errors.Join(fmt.Errorf("disabling adopted route: %w", err), m.save())
				}
				return nil
			}
		}
	}

	return fmt.Errorf("route not found")
}

func sliceContains(list []string, item string) bool {
	for _, s := range list {
		if s == item {
			return true
		}
	}
	return false
}

func normalizeDst(dst string) string {
	dst = strings.TrimSpace(dst)
	if dst == "" || dst == "default" || dst == "0.0.0.0/0" {
		return "default"
	}
	if !strings.Contains(dst, "/") && net.ParseIP(dst) != nil {
		return dst + "/32"
	}
	return dst
}

func detectGatewayForInterface(ifaceName string) string {
	link, err := netlink.LinkByName(ifaceName)
	if err == nil {
		routes, err := netlink.RouteList(link, netlink.FAMILY_V4)
		if err == nil {
			for _, r := range routes {
				if (r.Dst == nil || r.Dst.IP.IsUnspecified()) && r.Gw != nil && !r.Gw.IsUnspecified() {
					return r.Gw.String()
				}
			}
			for _, r := range routes {
				if r.Gw != nil && !r.Gw.IsUnspecified() {
					return r.Gw.String()
				}
			}
		}
	}
	out, err := exec.Command("ip", "route", "show", "dev", ifaceName).CombinedOutput()
	if err == nil {
		lines := strings.Split(string(out), "\n")
		for _, l := range lines {
			if strings.Contains(l, "via ") {
				fields := strings.Fields(l)
				for i, f := range fields {
					if f == "via" && i+1 < len(fields) {
						gw := fields[i+1]
						if net.ParseIP(gw) != nil {
							return gw
						}
					}
				}
			}
		}
	}
	return ""
}

func (m *RoutingManager) syncRouteGroupToKernel(dstAddress, routingTable string, distance int) error {
	normDst := normalizeDst(dstAddress)
	tbl := strings.TrimSpace(routingTable)
	if tbl == "" {
		tbl = "main"
	}

	var activeRoutes []RouteItem
	for _, r := range m.staticRoutes {
		rDst := normalizeDst(r.DstAddress)
		rTbl := strings.TrimSpace(r.RoutingTable)
		if rTbl == "" {
			rTbl = "main"
		}
		if rDst == normDst && rTbl == tbl && r.Distance == distance {
			if !r.Disabled && r.Active && r.HealthStatus != "offline" {
				activeRoutes = append(activeRoutes, r)
			}
		}
	}

	if len(activeRoutes) == 0 {
		// Safety guard: if all default routes are marked offline, do NOT delete the default route into a blackout!
		// Fallback to keeping all enabled static routes in the group active so recovery traffic and emergency pings can flow.
		if normDst == "default" {
			var fallbackRoutes []RouteItem
			for _, r := range m.staticRoutes {
				rDst := normalizeDst(r.DstAddress)
				rTbl := strings.TrimSpace(r.RoutingTable)
				if rTbl == "" {
					rTbl = "main"
				}
				if rDst == normDst && rTbl == tbl && r.Distance == distance && !r.Disabled {
					fallbackRoutes = append(fallbackRoutes, r)
				}
			}
			if len(fallbackRoutes) > 0 {
				log.Printf("[RouteManager] All default routes offline in group! Keeping fallback routes active to prevent blackout")
				activeRoutes = fallbackRoutes
			}
		}
	}

	if len(activeRoutes) == 0 {
		// Only touch the requested static route group. Broad fallbacks can delete
		// a route from another table, metric, or routing protocol.
		for _, routeType := range []string{"", "blackhole"} {
			args := []string{"route", "del"}
			if routeType != "" {
				args = append(args, routeType)
			}
			args = append(args, normDst, "metric", strconv.Itoa(distance), "table", tbl, "proto", "static")
			out, err := exec.Command("ip", args...).CombinedOutput()
			missing := strings.Contains(string(out), "No such process") || (tbl == "main" && strings.Contains(string(out), "FIB table does not exist"))
			if err != nil && !missing {
				return fmt.Errorf("failed to delete static route group (%s): %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
			}
		}
		return nil
	}

	type expandedNexthop struct {
		Gateway   string
		Interface string
		Weight    int
	}

	var allNexthops []expandedNexthop
	isBlackhole := false

	for _, r := range activeRoutes {
		gw := strings.TrimSpace(r.Gateway)
		iface := strings.TrimSpace(r.Interface)

		if strings.EqualFold(gw, "blackhole") || strings.EqualFold(r.Action, "blackhole") {
			isBlackhole = true
			break
		}

		// Check if interface or gateway specifies an SD-WAN virtual group
		targetSDWAN := ""
		if sdwan.IsSDWANGroup(iface) {
			targetSDWAN = iface
		} else if sdwan.IsSDWANGroup(gw) {
			targetSDWAN = gw
		}

		if targetSDWAN != "" {
			resolved, ok := sdwan.ResolveGroupForRouting(targetSDWAN)
			if ok && len(resolved) > 0 {
				for _, nh := range resolved {
					allNexthops = append(allNexthops, expandedNexthop{
						Gateway:   nh.Gateway,
						Interface: nh.Interface,
						Weight:    nh.Weight,
					})
				}
				continue
			}
		}

		// Standard static route
		if gw != "" && net.ParseIP(gw) == nil && iface == "" {
			iface = gw
			gw = ""
		}
		if gw == "" && iface != "" {
			gw = detectGatewayForInterface(iface)
		}

		allNexthops = append(allNexthops, expandedNexthop{
			Gateway:   gw,
			Interface: iface,
			Weight:    1,
		})
	}

	if isBlackhole {
		args := []string{"route", "replace", "blackhole", normDst}
		if distance > 0 {
			args = append(args, "metric", strconv.Itoa(distance))
		}
		if tbl != "main" {
			args = append(args, "table", tbl)
		}
		args = append(args, "proto", "static")
		if out, err := exec.Command("ip", args...).CombinedOutput(); err != nil {
			return fmt.Errorf("failed to apply blackhole route: %s: %w", string(out), err)
		}
		return nil
	}

	if len(allNexthops) == 0 {
		return nil
	}

	if len(allNexthops) == 1 {
		nh := allNexthops[0]
		args := []string{"route", "replace", normDst}
		hasVia := false
		if nh.Gateway != "" && net.ParseIP(nh.Gateway) != nil {
			args = append(args, "via", nh.Gateway)
			hasVia = true
		}
		if nh.Interface != "" {
			args = append(args, "dev", nh.Interface)
		}
		if hasVia && nh.Interface != "" {
			args = append(args, "onlink")
		}
		if distance > 0 {
			args = append(args, "metric", strconv.Itoa(distance))
		}
		if tbl != "main" {
			args = append(args, "table", tbl)
		}
		args = append(args, "proto", "static")

		cmd := exec.Command("ip", args...)
		if out, err := cmd.CombinedOutput(); err != nil {
			if sliceContains(args, "onlink") {
				var noOnlinkArgs []string
				for _, a := range args {
					if a != "onlink" {
						noOnlinkArgs = append(noOnlinkArgs, a)
					}
				}
				if _, fbErr := exec.Command("ip", noOnlinkArgs...).CombinedOutput(); fbErr == nil {
					return nil
				}
			}
			return fmt.Errorf("failed to apply route (%s): %s: %w", strings.Join(args, " "), string(out), err)
		}
		return nil
	}

	// Multiple nexthops: ECMP multipath route
	args := []string{"route", "replace", normDst, "scope", "global"}
	if distance > 0 {
		args = append(args, "metric", strconv.Itoa(distance))
	}
	if tbl != "main" {
		args = append(args, "table", tbl)
	}
	args = append(args, "proto", "static")

	for _, nh := range allNexthops {
		args = append(args, "nexthop")
		hasVia := false
		if nh.Gateway != "" && net.ParseIP(nh.Gateway) != nil {
			args = append(args, "via", nh.Gateway)
			hasVia = true
		}
		if nh.Interface != "" {
			args = append(args, "dev", nh.Interface)
		}
		if hasVia && nh.Interface != "" {
			args = append(args, "onlink")
		}
		w := nh.Weight
		if w <= 0 {
			w = 1
		}
		args = append(args, "weight", strconv.Itoa(w))
	}

	cmd := exec.Command("ip", args...)
	if out, err := cmd.CombinedOutput(); err != nil {
		if sliceContains(args, "onlink") {
			var noOnlinkArgs []string
			for _, a := range args {
				if a != "onlink" {
					noOnlinkArgs = append(noOnlinkArgs, a)
				}
			}
			if _, fbErr := exec.Command("ip", noOnlinkArgs...).CombinedOutput(); fbErr == nil {
				return nil
			}
		}
		return fmt.Errorf("failed to apply multipath route (%s): %s: %w", strings.Join(args, " "), string(out), err)
	}
	return nil
}

// SyncSDWANRoutes reapplies kernel routes for static routes referencing SD-WAN groups when group state changes.
func (m *RoutingManager) SyncSDWANRoutes() {
	m.mu.Lock()
	defer m.mu.Unlock()

	type groupKey struct {
		dst   string
		table string
		dist  int
	}
	seen := make(map[groupKey]bool)
	var groupsToSync []groupKey

	for _, r := range m.staticRoutes {
		if r.Disabled {
			continue
		}
		if sdwan.IsSDWANGroup(r.Interface) || sdwan.IsSDWANGroup(r.Gateway) {
			tbl := strings.TrimSpace(r.RoutingTable)
			if tbl == "" {
				tbl = "main"
			}
			normDst := normalizeDst(r.DstAddress)
			k := groupKey{dst: normDst, table: tbl, dist: r.Distance}
			if !seen[k] {
				seen[k] = true
				groupsToSync = append(groupsToSync, groupKey{dst: r.DstAddress, table: tbl, dist: r.Distance})
			}
		}
	}

	for _, g := range groupsToSync {
		if err := m.syncRouteGroupToKernel(g.dst, g.table, g.dist); err != nil {
			log.Printf("[RouteManager] SD-WAN failover route sync failed for %s (%s metric %d): %v", g.dst, g.table, g.dist, err)
		} else {
			log.Printf("[RouteManager] SD-WAN failover synced route %s (%s metric %d) successfully", g.dst, g.table, g.dist)
		}
	}
}

func (m *RoutingManager) applyRouteToKernel(r RouteItem) error {
	return m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance)
}

func (m *RoutingManager) removeRouteFromKernel(r RouteItem) error {
	return m.syncRouteGroupToKernel(r.DstAddress, r.RoutingTable, r.Distance)
}

func (m *RoutingManager) deleteDirectKernelRoute(r RouteItem) error {
	normDst := normalizeDst(r.DstAddress)
	gw := strings.TrimSpace(r.Gateway)
	isBlackhole := strings.EqualFold(gw, "blackhole") || strings.EqualFold(r.Action, "blackhole")

	var args []string
	if isBlackhole {
		args = []string{"route", "del", "blackhole", normDst}
	} else {
		args = []string{"route", "del", normDst}
		if gw != "" && net.ParseIP(gw) != nil {
			args = append(args, "via", gw)
		}
		iface := strings.TrimSpace(r.Interface)
		if iface != "" {
			args = append(args, "dev", iface)
		}
	}
	if r.RoutingTable != "" && r.RoutingTable != "main" {
		args = append(args, "table", r.RoutingTable)
	}
	if r.Distance > 0 {
		args = append(args, "metric", strconv.Itoa(r.Distance))
	}
	out, err := exec.Command("ip", args...).CombinedOutput()
	if err != nil {
		return fmt.Errorf("failed to delete route (%s): %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
	}
	return nil
}

// ==================== Policy Rules (/ip route rule) ====================

func (m *RoutingManager) ListPolicyRules() []PolicyRuleItem {
	m.mu.Lock()
	defer m.mu.Unlock()

	// Query live rules from kernel
	rules, err := netlink.RuleList(netlink.FAMILY_V4)
	if err != nil {
		return m.policyRules
	}

	tableNames := m.getTableMap()
	var res []PolicyRuleItem

	actions, actionErr := m.listKernelPolicyActions()
	if actionErr != nil {
		log.Printf("policy rule action lookup failed: %v", actionErr)
	}
	userRulesByPrio := make(map[int][]PolicyRuleItem)
	for _, pr := range m.policyRules {
		userRulesByPrio[pr.Priority] = append(userRulesByPrio[pr.Priority], pr)
	}
	matchedManaged := make(map[string]bool)

	for _, r := range rules {
		tableName := "main"
		if name, ok := tableNames[r.Table]; ok {
			tableName = name
		} else if r.Table != 254 && r.Table != 0 {
			tableName = strconv.Itoa(r.Table)
		}

		src := ""
		if r.Src != nil {
			src = r.Src.String()
		}
		dst := ""
		if r.Dst != nil {
			dst = r.Dst.String()
		}

		markStr := ""
		if r.Mark > 0 {
			markStr = fmt.Sprintf("0x%x (%d)", r.Mark, r.Mark)
		}

		action := actions[policyKernelKey(r.Priority, src, dst, r.Mark, r.Table)]
		if action == "" {
			action = "unknown"
		}
		if action != "lookup" {
			tableName = ""
		}
		id := fmt.Sprintf("rule-%d-%d", r.Priority, r.Table)
		comment := ""
		isDefault := false
		isSystem := false

		if r.Priority == 0 || r.Priority == 32766 || r.Priority == 32767 {
			isDefault = true
			isSystem = true
		} else {
			// A priority alone does not identify a rule: kernel priorities may be shared.
			isSystem = true
			for _, userRule := range userRulesByPrio[r.Priority] {
				if !matchedManaged[userRule.ID] && m.matchesPolicyRule(userRule, r, action) {
					id, comment, isSystem = userRule.ID, userRule.Comment, false
					matchedManaged[userRule.ID] = true
					break
				}
			}
		}

		res = append(res, PolicyRuleItem{
			ID:          id,
			Priority:    r.Priority,
			SrcAddress:  src,
			DstAddress:  dst,
			RoutingMark: markStr,
			Table:       tableName,
			TableID:     r.Table,
			Action:      action,
			Comment:     comment,
			IsDefault:   isDefault,
			IsSystem:    isSystem,
		})
	}

	return res
}

type policyJSONRule struct {
	Priority int             `json:"priority"`
	Src      string          `json:"src"`
	SrcLen   *int            `json:"srclen"`
	Dst      string          `json:"dst"`
	DstLen   *int            `json:"dstlen"`
	Mark     string          `json:"fwmark"`
	Table    json.RawMessage `json:"table"`
	Action   string          `json:"action"`
}

func policyKernelKey(priority int, src, dst string, mark uint32, table int) string {
	return fmt.Sprintf("%d|%s|%s|%d|%d", priority, normalizedRulePrefix(src), normalizedRulePrefix(dst), mark, table)
}
func jsonRulePrefix(addr string, bits *int) string {
	if addr == "" || addr == "all" {
		return ""
	}
	if bits == nil {
		return addr
	}
	return fmt.Sprintf("%s/%d", addr, *bits)
}

// netlink v1.3.1 does not populate Rule.Type, so obtain actions from iproute2.
// Ambiguous snapshots are intentionally not attributed to managed rules.
func (m *RoutingManager) listKernelPolicyActions() (map[string]string, error) {
	out, err := exec.Command("ip", "-j", "-4", "rule", "show").CombinedOutput()
	if err != nil {
		return nil, fmt.Errorf("listing policy actions: %s: %w", strings.TrimSpace(string(out)), err)
	}
	var rules []policyJSONRule
	if err = json.Unmarshal(out, &rules); err != nil {
		return nil, fmt.Errorf("parsing policy rules: %w", err)
	}
	result := make(map[string]string)
	for _, r := range rules {
		var table int
		if len(r.Table) > 0 && string(r.Table) != "null" {
			var name string
			if json.Unmarshal(r.Table, &name) == nil {
				table = m.getTableIDByName(name)
			} else if err = json.Unmarshal(r.Table, &table); err != nil {
				return nil, fmt.Errorf("invalid policy table: %w", err)
			}
		}
		action := strings.ToLower(r.Action)
		if action == "" && table != 0 {
			action = "lookup"
		}
		if action == "" {
			action = "unknown"
		}
		var mark uint64
		if r.Mark != "" {
			mark, err = strconv.ParseUint(strings.Split(r.Mark, "/")[0], 0, 32)
			if err != nil {
				return nil, fmt.Errorf("invalid policy mark: %w", err)
			}
		}
		key := policyKernelKey(r.Priority, jsonRulePrefix(r.Src, r.SrcLen), jsonRulePrefix(r.Dst, r.DstLen), uint32(mark), table)
		if _, exists := result[key]; exists {
			result[key] = ""
		} else {
			result[key] = action
		}
	}
	return result, nil
}
func normalizedRulePrefix(value string) string {
	value = strings.TrimSpace(value)
	if value == "" {
		return ""
	}
	if ip := net.ParseIP(value); ip != nil {
		if ip.To4() != nil {
			return ip.String() + "/32"
		}
		return ip.String() + "/128"
	}
	_, network, err := net.ParseCIDR(value)
	if err != nil {
		return value
	}
	ones, _ := network.Mask.Size()
	if ones == 0 {
		return ""
	}
	return network.String()
}
func (m *RoutingManager) matchesPolicyRule(saved PolicyRuleItem, live netlink.Rule, liveAction string) bool {
	if saved.Priority != live.Priority || live.IifName != "" || live.OifName != "" || live.Invert || live.Tos != 0 {
		return false
	}
	action := saved.Action
	if action == "" {
		action = "lookup"
	}
	if action != liveAction {
		return false
	}
	if action == "lookup" && m.getTableIDByName(saved.Table) != live.Table {
		return false
	}
	src, dst := "", ""
	if live.Src != nil {
		src = live.Src.String()
	}
	if live.Dst != nil {
		dst = live.Dst.String()
	}
	if normalizedRulePrefix(saved.SrcAddress) != normalizedRulePrefix(src) || normalizedRulePrefix(saved.DstAddress) != normalizedRulePrefix(dst) {
		return false
	}
	mark := strings.TrimSpace(strings.Split(saved.RoutingMark, "(")[0])
	var expected uint64
	if mark != "" {
		var err error
		expected, err = strconv.ParseUint(mark, 0, 32)
		if err != nil {
			return false
		}
	}
	if uint32(expected) != live.Mark {
		return false
	}
	if mark == "" && live.Mask != nil {
		return false
	}
	if mark != "" && expected == 0 && live.Mask == nil {
		return false
	}
	if live.Mask != nil && *live.Mask != ^uint32(0) {
		return false
	}
	return true
}

func (m *RoutingManager) SavePolicyRule(pr PolicyRuleItem) error {
	m.mu.Lock()
	defer m.mu.Unlock()
	pr.Action = strings.ToLower(strings.TrimSpace(pr.Action))
	if pr.Action == "" {
		pr.Action = "lookup"
	}
	switch pr.Action {
	case "lookup":
		if pr.Table == "" {
			pr.Table = "main"
		}
	case "blackhole", "unreachable", "prohibit":
		pr.Table = ""
		pr.TableID = 0
	default:
		return fmt.Errorf("invalid policy rule action: %s", pr.Action)
	}
	if pr.ID == "" {
		pr.ID = fmt.Sprintf("prule-%d", time.Now().UnixNano())
	}
	if pr.Priority == 0 {
		pr.Priority = 1000 + len(m.policyRules)*10
	}
	if pr.Priority <= 0 || pr.Priority == 32766 || pr.Priority == 32767 {
		return fmt.Errorf("invalid or reserved policy rule priority")
	}
	for _, existing := range m.policyRules {
		if existing.ID == pr.ID || existing.Priority == pr.Priority {
			return fmt.Errorf("policy rule ID or priority already exists")
		}
	}
	liveRules, err := netlink.RuleList(netlink.FAMILY_V4)
	if err != nil {
		return fmt.Errorf("listing existing policy rules: %w", err)
	}
	actions, err := m.listKernelPolicyActions()
	if err != nil {
		return err
	}
	for _, live := range liveRules {
		if live.Priority != pr.Priority {
			continue
		}
		src, dst := "", ""
		if live.Src != nil {
			src = live.Src.String()
		}
		if live.Dst != nil {
			dst = live.Dst.String()
		}
		action := actions[policyKernelKey(live.Priority, src, dst, live.Mark, live.Table)]
		if action == "" {
			return fmt.Errorf("ambiguous existing policy rule state; retry")
		}
		if m.matchesPolicyRule(pr, live, action) {
			return fmt.Errorf("matching policy rule already exists in kernel")
		}
	}
	if err := m.applyRuleToKernel(pr); err != nil {
		return err
	}
	before := append([]PolicyRuleItem(nil), m.policyRules...)
	m.policyRules = append(m.policyRules, pr)
	if err := m.save(); err != nil {
		m.policyRules = before
		persistErr := m.save()
		if persistErr != nil {
			persistErr = fmt.Errorf("restoring saved policy rules: %w", persistErr)
		}
		rollbackErr := m.removeRuleFromKernel(pr)
		if rollbackErr != nil {
			rollbackErr = fmt.Errorf("removing new kernel rule: %w", rollbackErr)
		}
		return errors.Join(fmt.Errorf("saving policy rule: %w", err), persistErr, rollbackErr)
	}
	return nil
}
func (m *RoutingManager) DeletePolicyRule(id string) error {
	m.mu.Lock()
	defer m.mu.Unlock()
	index := -1
	for i, pr := range m.policyRules {
		if pr.ID == id || fmt.Sprintf("rule-%d-%d", pr.Priority, pr.TableID) == id {
			index = i
			break
		}
	}
	if index < 0 {
		return fmt.Errorf("managed policy rule not found: %s", id)
	}
	before := append([]PolicyRuleItem(nil), m.policyRules...)
	target := m.policyRules[index]
	if err := m.removeRuleFromKernel(target); err != nil {
		return err
	}
	m.policyRules = append(m.policyRules[:index:index], m.policyRules[index+1:]...)
	if err := m.save(); err != nil {
		m.policyRules = before
		persistErr := m.save()
		if persistErr != nil {
			persistErr = fmt.Errorf("restoring saved policy rules: %w", persistErr)
		}
		rollbackErr := m.applyRuleToKernel(target)
		if rollbackErr != nil {
			rollbackErr = fmt.Errorf("restoring kernel rule: %w", rollbackErr)
		}
		return errors.Join(fmt.Errorf("saving policy rule deletion: %w", err), persistErr, rollbackErr)
	}
	return nil
}
func policyRuleArgs(verb string, pr PolicyRuleItem) ([]string, error) {
	action := strings.ToLower(strings.TrimSpace(pr.Action))
	if action == "" {
		action = "lookup"
	}
	args := []string{"rule", verb}
	if pr.Priority > 0 {
		args = append(args, "pref", strconv.Itoa(pr.Priority))
	}
	if pr.SrcAddress != "" {
		args = append(args, "from", pr.SrcAddress)
	}
	if pr.DstAddress != "" {
		args = append(args, "to", pr.DstAddress)
	}
	if pr.RoutingMark != "" {
		mark := pr.RoutingMark
		if strings.Contains(mark, "(") {
			mark = strings.TrimSpace(mark[:strings.Index(mark, "(")])
		}
		args = append(args, "fwmark", mark)
	}
	switch action {
	case "lookup":
		table := pr.Table
		if table == "" {
			table = "main"
		}
		args = append(args, "lookup", table)
	case "blackhole", "unreachable", "prohibit":
		args = append(args, action)
	default:
		return nil, fmt.Errorf("invalid policy rule action: %s", action)
	}
	return args, nil
}
func (m *RoutingManager) applyRuleToKernel(pr PolicyRuleItem) error {
	args, err := policyRuleArgs("add", pr)
	if err != nil {
		return err
	}
	out, err := exec.Command("ip", args...).CombinedOutput()
	if err != nil {
		return fmt.Errorf("failed to add rule (%s): %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
	}
	return nil
}
func (m *RoutingManager) removeRuleFromKernel(pr PolicyRuleItem) error {
	args, err := policyRuleArgs("del", pr)
	if err != nil {
		return err
	}
	out, err := exec.Command("ip", args...).CombinedOutput()
	if err != nil {
		return fmt.Errorf("failed to delete rule (%s): %s: %w", strings.Join(args, " "), strings.TrimSpace(string(out)), err)
	}
	return nil
}

// ==================== Routing Tables ====================

func (m *RoutingManager) ListTables() []RoutingTableItem {
	m.mu.Lock()
	defer m.mu.Unlock()

	tables := []RoutingTableItem{
		{Name: "main", TableID: 254, Comment: "Default system routing table"},
		{Name: "default", TableID: 253, Comment: "Default fallback table"},
		{Name: "local", TableID: 255, Comment: "Local kernel device table"},
	}

	tables = append(tables, m.customTables...)
	return tables
}

func (m *RoutingManager) SaveTable(t RoutingTableItem) error {
	m.mu.Lock()
	defer m.mu.Unlock()

	t.Name = strings.TrimSpace(t.Name)
	if t.Name == "" || !regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_.-]*$`).MatchString(t.Name) {
		return fmt.Errorf("invalid routing table name")
	}
	if t.TableID < 0 || uint64(t.TableID) > uint64(^uint32(0)) {
		return fmt.Errorf("invalid routing table ID")
	}
	if t.TableID == 0 {
		// Auto assign FIB ID starting at 100
		t.TableID = 100 + len(m.customTables)
	}

	for id, name := range m.getTableMap() {
		if strings.EqualFold(name, t.Name) || id == t.TableID {
			return fmt.Errorf("table with name %q or ID %d already exists", t.Name, t.TableID)
		}
	}

	before := append([]RoutingTableItem(nil), m.customTables...)
	m.customTables = append(m.customTables, t)
	if err := m.save(); err != nil {
		m.customTables = before
		return errors.Join(fmt.Errorf("saving routing table: %w", err), m.save())
	}
	if err := m.syncCustomTablesToSystem(); err != nil {
		m.customTables = before
		restoreErr := m.save()
		if restoreErr != nil {
			restoreErr = fmt.Errorf("restoring saved routing tables: %w", restoreErr)
		}
		return errors.Join(fmt.Errorf("registering routing table: %w", err), restoreErr)
	}
	return nil
}

func (m *RoutingManager) getTableMap() map[int]string {
	tableMap := map[int]string{
		254: "main",
		253: "default",
		255: "local",
	}

	// Read /etc/iproute2/rt_tables
	if f, err := os.Open(RTTableFilePath); err == nil {
		defer f.Close()
		scanner := bufio.NewScanner(f)
		for scanner.Scan() {
			line := strings.TrimSpace(scanner.Text())
			if line == "" || strings.HasPrefix(line, "#") {
				continue
			}
			parts := strings.Fields(line)
			if len(parts) >= 2 {
				if id, err := strconv.Atoi(parts[0]); err == nil {
					tableMap[id] = parts[1]
				}
			}
		}
	}

	for _, t := range m.customTables {
		tableMap[t.TableID] = t.Name
	}

	return tableMap
}

func (m *RoutingManager) Stop() {
	if m.stopChan != nil {
		select {
		case <-m.stopChan:
		default:
			close(m.stopChan)
		}
	}
}

// RenameInterface updates static routes and policy rules when an interface is renamed.
func (m *RoutingManager) RenameInterface(oldName, newName string) {
	m.mu.Lock()
	defer m.mu.Unlock()

	changed := false
	for i := range m.staticRoutes {
		if m.staticRoutes[i].Interface == oldName {
			m.staticRoutes[i].Interface = newName
			changed = true
		}
		if m.staticRoutes[i].Gateway == oldName {
			m.staticRoutes[i].Gateway = newName
			changed = true
		}
	}
	if changed {
		_ = m.save()
	}
}